28 GRC Professional • Summer 2013
COMMENT
the organisation. It needs cultural change and
proper risk allocation to encourage people in the
business to take lawful actions only and to resist
unlawful actions -- regardless of the potential profit
that stands to be made. One tool of leverage that is
in disuse in a dusty corner is consequence.
GRC as a framework and as a function has
never been given the power or the ability to
impose consequence within organisations. The
impotency of GRC as a policeman and the lack
of positive drivers to motivate behaviour in the
financial sector have, in effect, left us where
we are today. We are now sifting through the
charred remains from the global financial crisis;
witnessing mammoth penalties get handed down
with alarming regularity; and watching from
afar as the Libor hearings reinforce the public's
dismal view of the ethical standards within some
financial institutions.
Power of penalties
If GRC is understandably powerless and
ineffective in promoting good conduct,
and culture change is merely a statement of
motherhood, then the only remaining force
weighing in on the activities of profit-makers
and takers is the force of law and regulation.
Law s and regulations covering the activities
of financial institutions, built on appropriate
criminal penalties, are the only external forces
that have a chance of changing the sca ndal-laden
world of financial institutions. Such laws and
regulations will only work if they are fearlessly
enforced by government, regulators and law
enforcement agencies alike. Criminal penalties
need to apply to corporations (loss of banking and
other licences, penalties, liability to shareholders)
and personally to directors, senior managers and
profit makers and takers.
When calling for a return to criminalisation of
activities engaged in by profit makers and takers
within financial institutions, we need go no
further than the concepts of fraud (such as in the
recent Libor scandal) and the crime of money-
laundering. Fraud is a criminal act. Money-
laundering is a criminal act. Yet those working
in financial institutions are seemingly immune
to any form of criminal prosecution. There are
some limited exceptions, such as the criminal
prosecution of Lucy Edwards and the Bank of
New York resulting in a 'slap on the wrist' home
detention order for Edwards, with no jail time
ser ved. Yet even the Bank of New York was able
to negotiate a delayed prosecution agreement after
it violated a cease-and-desist agreement in the
same matter.
If the risk is that a civil penalty might roll out of
the door of the regulator in three or five years' time,
what deterrence value is there? By the time a civil
penalty is imposed, the profit makers and takers
involved will have moved on to another financial
institution or taken up residence in other rolled-
gold pastures. Despite the attempted reforms to
remuneration practices, in most cases the bonuses
will have been paid and options exercised long
before the regulators swoop.
The past decade has shown that GRC has not had
an effective seat at the executive table. If it had a
The past
decade has
shown that
GRC has
not had an
effective
seat at the
executive
table.